CVE-2026-74445

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: reject DX_BIND_QUERY without a DX context

vmw_cmd_dx_bind_query() unconditionally dereferences

sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer

dereference from any render-node fd by submitting an execbuf with

dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY

opcode in the command stream: dx_ctx_node is left NULL and the kernel

oopses on the assignment. The same NULL is then re-read in

vmw_resources_reserve() via vmw_context_get_dx_query_mob().

All sibling DX handlers fail-close on a missing dx_ctx_node using

VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up

front before any relocation state is published.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References